[IMPALA-13049] Add dependency management for the log4j2 version

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: Impala 4.4.0
• Fix Version/s: Impala 4.5.0
• Component/s: Frontend, Infrastructure
• Epic Color: ghx-label-7
• Assignee: Joe McDonnell
• Reporter: Joe McDonnell
• Created: 30/Apr/24 20:07
• Updated: 01/May/24 19:43
• Resolved: 01/May/24 19:43

Description

In some internal builds, we see cases where one dependency brings in one version of log4j2 and another brings in a different version on a different artifact. In particular, we have seen cases where Hive brings in log4j-api 2.17.1 while something else brings in log4j-core 2.18.0. This is a bad combination, because log4j-core 2.18.0 relies on the ServiceLoaderUtil class existing in log4j-api, but log4j-api 2.17.1 doesn't have it. This can result in class not found exceptions.

Impala itself uses reload4j rather than log4j2, so this is purely about coordinating dependencies rather than Impala code.

We should add dependency management for log4j-api and log4j-core. It makes sense to standardize on 2.18.0.